aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

doc: fixed HOME_NET/EXTERNAL example formatting

Browse Source 
Signed-off-by: jason taylor <jtfas90@gmail.com>
pull/7603/head
jason taylor 3 years ago committed by Victor Julien
parent f2c7998903
commit 3eeacf8a3d
1 changed files with 5 additions and 5 deletions
Show Stats Download Patch File Download Diff File

10
doc/userguide/rules/intro.rst
Unescape Escape View File

@ -140,7 +140,7 @@ For example:
================================== ========================================== ================================== ==========================================
Example Meaning Example Meaning
================================== ========================================== ================================== ==========================================
! 1.1.1.1 Every IP address but 1.1.1.1 !1.1.1.1 Every IP address but 1.1.1.1
![1.1.1.1, 1.1.1.2] Every IP address but 1.1.1.1 and 1.1.1.2 ![1.1.1.1, 1.1.1.2] Every IP address but 1.1.1.1 and 1.1.1.2
$HOME_NET Your setting of HOME_NET in yaml $HOME_NET Your setting of HOME_NET in yaml
[$EXTERNAL_NET, !$HOME_NET] EXTERNAL_NET and not HOME_NET [$EXTERNAL_NET, !$HOME_NET] EXTERNAL_NET and not HOME_NET
@ -154,10 +154,10 @@ $HOME_NET Your setting of HOME_NET in yaml
If you set your configuration to something like this:: If you set your configuration to something like this::
HOME_NET: any HOME_NET: any
EXTERNAL_NET: ! $HOME_NET EXTERNAL_NET: !$HOME_NET
You can not write a signature using ``$EXTERNAL_NET`` because it stands for You cannot write a signature using ``$EXTERNAL_NET`` because it evaluates to
'not any'. This is an invalid setting. 'not any', which is an invalid value.
Ports (source and destination) Ports (source and destination)
------------------------------ ------------------------------
@ -165,7 +165,7 @@ Ports (source and destination)
alert http $HOME_NET :example-rule-emphasis:`any` -> $EXTERNAL_NET :example-rule-emphasis:`any` (msg:"HTTP GET Request Containing Rule in URI"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"rule"; fast_pattern; classtype:bad-unknown; sid:123; rev:1;) alert http $HOME_NET :example-rule-emphasis:`any` -> $EXTERNAL_NET :example-rule-emphasis:`any` (msg:"HTTP GET Request Containing Rule in URI"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"rule"; fast_pattern; classtype:bad-unknown; sid:123; rev:1;)
*The first emphasized part is the source, the second is the destination (note the direction of the directional arrow).* *The first emphasized part is the source port, the second is the destination port (note the direction of the directional arrow).*
Traffic comes in and goes out through ports. Different ports have Traffic comes in and goes out through ports. Different ports have
different port numbers. For example, the default port for HTTP is 80 while 443 is different port numbers. For example, the default port for HTTP is 80 while 443 is

Write Preview
Loading…
Cancel
Save